https://blog.omiilgo.com/tags/appsec/ Recent content in Appsec on Security Notes Hugo en-us Sat, 11 Apr 2026 09:00:00 +0800 https://blog.omiilgo.com/posts/financial-apps-concurrency-vs-authz/ Sat, 11 Apr 2026 09:00:00 +0800 https://blog.omiilgo.com/posts/financial-apps-concurrency-vs-authz/ Lab SQLite ledger: UPDATE without a version column vs WITH version, plus an IDOR that is not a race — no money-drain client. https://blog.omiilgo.com/posts/command-injection-taxonomy/ Sat, 05 Sep 2020 14:00:00 +0800 https://blog.omiilgo.com/posts/command-injection-taxonomy/ Lab Python ping wrapper: subprocess shell=True vs argv list, dangerous call, the fix, ASAN-irrelevant crash on a C popen helper — no reverse shell.